Re: [quicwg/base-drafts] What needs to be checked for address validation (#3327)

[Martin Thomson <[e-mail]>]

martinthomson commented on this pull request.



> @@ -1834,10 +1834,9 @@ SHOULD include information that allows the server to verify that the source IP
 address and port in client packets remains constant.
 
 Servers might use tokens from NEW_TOKEN in deciding not to send a Retry packet,
-even if the client address has changed.  A token that was provided in
-NEW_TOKEN cannot be used for address validation if the client address is not the
-same, though servers MAY allow for the possibility of changes arising from new
-mappings at a NAT.
+even if the client address has changed. Tokens sent in NEW_TOKEN frames SHOULD
+include information that allows the server to verify if the client address is
+stable, but might allow for different NAT bindings or ephemeral port selection.

== on IP and port would be one example, but the emphemeral port example clearly leads to just IP == IP.

Should we just say "IP MUST be the same" instead?  That's not good always (see CGNAT) and I want to avoid creating the impression that this is sufficient, even if it might be sufficient.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/3327#discussion_r379941990